Ako vykona� overovanie na z�klade formul�rov v ASP.NET aplik�cie pomocou C #.NET

Tento �l�nok demon�truje, ako implementova� z�klade formul�rov overovanie pomocou datab�zy pre ukladanie u��vate�om.

Po�iadavky

Nasleduj�ci zoznam popisuje Odpor��an� hardv�r, softv�r, sie�ovej infra�trukt�ry a bal�ky service pack, ktor� potrebujete:

• Microsoft Visual Studio .NET
• Microsoft Internet Information Services (IIS) verzie 5.0 alebo nov��
• Microsoft SQL Server

Vytvori� ASP.NET aplik�ciu pomocou C# .NET

1. Otvoren� Visual Studio .NET.
2. Vytvori� nov� aplik�ciu ASP.NET Web, a uve�te n�zov a umiestnenie.

V s�bore Web.config nakonfigurova� nastavenia zabezpe�enia

T�to �as� ukazuje, ako prida� a upravi� <authentication></authentication> a <authorization></authorization> konfigur�cie sekcie nakonfigurova� ASP.NET aplik�cie pou��va� overovanie na z�klade formul�rov.

1. V roztoku Explorer, otvorte s�bor Web.config.
2. Zmeni� re�im overovania formul�rov.
3. Vlo�te zna�ku <Forms>a vypl�te pr�slu�n� atrib�ty. (�al�ie inform�cie o t�chto atrib�tov ozna�ova� MSDN dokument�ciu alebo QuickStart dokument�cie, ktor� je uveden� v </Forms>REFERENCIE oddiel) K�pia nasleduj�ci k�d a potom kliknite Prilepi� ako HTML naUpravi� menu vlo�i� k�d v <authentication></authentication> s�boru:

   <authentication mode="Forms">
      <forms name=".ASPXFORMSDEMO" loginUrl="logon.aspx" 
      protection="All" path="/" timeout="30" />
   </authentication> 
   					

4. Odoprie� pr�stup k anonymn�m pou��vate�om v <authorization></authorization> sekcie nasledovne:

   <authorization>
      <deny users ="?" />
      <allow users = "*" />
   </authorization>
   					

Vytvorte tabu�ku datab�zy vzorky na obchod u��vate�ov Podrobnosti

T�to sekcia demon�truje ako vytvori� uk�kov� datab�zu na ulo�i� u��vate�sk� meno, heslo a �lohu pre pou��vate�ov. Potrebujete st�pce Rola Ak chcete ulo�i� roly pou��vate�ov v datab�ze a implementova� role-based zabezpe�enia.

1. Na �tart menu, kliknite na tla�idloSpusti�, a potom zadajte Pozn�mkov� blok otvori� Pozn�mkov� blok.
2. Zv�raznite nasleduj�ci k�d skriptu SQL, kliknite prav�m tla�idlom my�i k�d, a potom kliknite na K�pia. V programe Pozn�mkov� blok, kliknitePasta na Upravi� menu vlo�i� nasleduj�ce k�d:

   if exists (select * from sysobjects where id = 
   object_id(N'[dbo].[Users]') and OBJECTPROPERTY(id, N'IsUserTable') = 1)
   drop table [dbo].[Users]
   GO
   CREATE TABLE [dbo].[Users] (
      [uname] [varchar] (15) NOT NULL ,
      [Pwd] [varchar] (25) NOT NULL ,
      [userRole] [varchar] (25) NOT NULL ,
   ) ON [PRIMARY]
   GO
   ALTER TABLE [dbo].[Users] WITH NOCHECK ADD 
      CONSTRAINT [PK_Users] PRIMARY KEY  NONCLUSTERED 
      (
         [uname]
      )  ON [PRIMARY] 
   GO
   
   INSERT INTO Users values('user1','user1','Manager')
   INSERT INTO Users values('user2','user2','Admin')
   INSERT INTO Users values('user3','user3','User')
   GO
   					

3. S�bor ulo�te ako Users.sql.
4. Na po��ta�i Microsoft SQL Server, otvorte Users.sql v Analyz�tor dotazu. Zo zoznamu datab�z, kliknite kr�my, a Spustite skript. To vytv�ra vzorka u��vate�ov tabu�ku a osad� tabu�ke v Kr�my datab�za sa pou�ije aplik�ciou tejto vzorky.

Vytvori� str�nku Logon.aspx

1. Prida� nov� webov� formul�r do projektu s n�zvom Logon.aspx.
2. Otvorte Logon.aspx str�nku v editore a prepn�� do HTML Zobrazi�.
3. Skop�rujte nasleduj�ci k�d a pou�itie Prilepi� ako HTML mo�nos� na Upravi� menu vlo�i� k�d medzi<form>Tagy: </form>

   <h3>
      <font face="Verdana">Logon Page</font>
   </h3>
   <table>
      <tr>
         <td>Email:</td>
         <td><input id="txtUserName" type="text" runat="server"></td>
         <td><ASP:RequiredFieldValidator ControlToValidate="txtUserName"
              Display="Static" ErrorMessage="*" runat="server" 
              ID="vUserName" /></td>
      </tr>
      <tr>
         <td>Password:</td>
         <td><input id="txtUserPass" type="password" runat="server"></td>
         <td><ASP:RequiredFieldValidator ControlToValidate="txtUserPass"
             Display="Static" ErrorMessage="*" runat="server" 
             ID="vUserPass" />
         </td>
      </tr>
      <tr>
         <td>Persistent Cookie:</td>
         <td><ASP:CheckBox id="chkPersistCookie" runat="server" autopostback="false" /></td>
         <td></td>
      </tr>
   </table>
   <input type="submit" Value="Logon" runat="server" ID="cmdLogin"><p></p>
   <asp:Label id="lblMsg" ForeColor="red" Font-Name="Verdana" Font-Size="10" runat="server" />
   						

   Tento webov� formul�r sa pou��va na prezentovanie prihlasovac� formul�r pou��vate�om, aby mohli poskytova� svoje u��vate�sk� meno a heslo na prihl�senie do aplik�cie.
4. Prepn�� do n�vrhov�ho zobrazenia a ulo�te str�nku.

K�du obsluhy udalost� tak, aby sa to overuje pou��vate�sk� poverenia

T�to sekcia predstavuje k�d, ktor� je umiestnen� v code-behind str�nke (Logon.aspx.cs).

1. Dvakr�t kliknite na Prihl�senie otvori� Logon.aspx.cs s�bor.
2. Importova� po�adovan� priestory n�zvov v s�bore k�d pozadu:

   using System.Data.SqlClient;
   using System.Web.Security;
   					

3. Vytvori� ValidateUser funkcia na overenie pou��vate�sk�ch poveren� pri poh�ade datab�za. (Uistite sa, �e zmeni� re�azec pripojenia k bodu na va�e Datab�za).

   private bool ValidateUser( string userName, string passWord )
   {
   	SqlConnection conn;
   	SqlCommand cmd;
   	string lookupPassword = null;
   
   	// Check for invalid userName.
   	// userName must not be null and must be between 1 and 15 characters.
   	if ( (  null == userName ) || ( 0 == userName.Length ) || ( userName.Length > 15 ) )
   	{
   		System.Diagnostics.Trace.WriteLine( "[ValidateUser] Input validation of userName failed." );
   		return false;
   	}
   
   	// Check for invalid passWord.
   	// passWord must not be null and must be between 1 and 25 characters.
   	if ( (  null == passWord ) || ( 0 == passWord.Length ) || ( passWord.Length > 25 ) )
   	{
   		System.Diagnostics.Trace.WriteLine( "[ValidateUser] Input validation of passWord failed." );
   		return false;
   	}
   
   	try
   	{
   		// Consult with your SQL Server administrator for an appropriate connection
   		// string to use to connect to your local SQL Server.
   		conn = new SqlConnection( "server=localhost;Integrated Security=SSPI;database=pubs" );
   		conn.Open();
   
   		// Create SqlCommand to select pwd field from users table given supplied userName.
   		cmd = new SqlCommand( "Select pwd from users where uname=@userName", conn );
   		cmd.Parameters.Add( "@userName", SqlDbType.VarChar, 25 );
   		cmd.Parameters["@userName"].Value = userName;
   
   		// Execute command and fetch pwd field into lookupPassword string.
   		lookupPassword = (string) cmd.ExecuteScalar();
   
   		// Cleanup command and connection objects.
   		cmd.Dispose();
   		conn.Dispose();
   	}
   	catch ( Exception ex )
   	{
   		// Add error handling here for debugging.
   		// This error message should not be sent back to the caller.
   		System.Diagnostics.Trace.WriteLine( "[ValidateUser] Exception " + ex.Message );
   	}
   
   	// If no password found, return false.
   	if ( null == lookupPassword ) 
   	{
   		// You could write failed login attempts here to event log for additional security.
   		return false;
   	}
   
   	// Compare lookupPassword and input passWord, using a case-sensitive comparison.
   	return ( 0 == string.Compare( lookupPassword, passWord, false ) );
   
   }
   					

4. M��ete pou�i� jeden z dvoch met�d pre generovanie formul�rov overovania cookie a presmerova� u��vate�a na pr�slu�n� str�nku v pr�pade cmdLogin_ServerClick . Uk�kov� k�d je k dispoz�cii pre oba scen�re. Pou�i� niektor� z ne pod�a va�ej po�iadavky.
   • Vola� met�du RedirectFromLoginPage automaticky generova� formy overovania cookie a presmerova� u��vate�a na pr�slu�n� str�nku v cmdLogin_ServerClick udalosti:

     private void cmdLogin_ServerClick(object sender, System.EventArgs e)
     {
     if (ValidateUser(txtUserName.Value,txtUserPass.Value) )
     	FormsAuthentication.RedirectFromLoginPage(txtUserName.Value,
     		chkPersistCookie.Checked);
     	else
     		Response.Redirect("logon.aspx", true);
     }
     						

   • Generova� overovania l�stok, za�ifrujte vytvoren� s�bor, vytvori� cookie, prida� k odpovedi, a presmerova� u��vate�a. To v�m d�va viac ovl�danie v ako vytv�ra� cookie. M��ete prida� aj vlastn� �daje pozd� s FormsAuthenticationTicket v tomto pr�pade.

     private void cmdLogin_ServerClick(object sender, System.EventArgs e)
     {
        if (ValidateUser(txtUserName.Value,txtUserPass.Value) )
        {
           FormsAuthenticationTicket tkt;
           string cookiestr;
           HttpCookie ck;
           tkt = new FormsAuthenticationTicket(1, txtUserName.Value, DateTime.Now, 
     DateTime.Now.AddMinutes(30), chkPersistCookie.Checked, "your custom data");
           cookiestr = FormsAuthentication.Encrypt(tkt);
           ck = new HttpCookie(FormsAuthentication.FormsCookieName, cookiestr);
           if (chkPersistCookie.Checked)
           ck.Expires=tkt.Expiration;	
     		    ck.Path = FormsAuthentication.FormsCookiePath; 
           Response.Cookies.Add(ck);
     
           string strRedirect;
           strRedirect = Request["ReturnUrl"];
           if (strRedirect==null)
                 strRedirect = "default.aspx";
              Response.Redirect(strRedirect, true);
        }
        else
           Response.Redirect("logon.aspx", true);
     }
     						

5. Uistite sa, �e sa prid�va tento k�d do InitializeComponent met�da v k�de, ktor� generuje n�vrh�r formul�ra Web:

   this.cmdLogin.ServerClick += new System.EventHandler(this.cmdLogin_ServerClick);
   					

Vytvori� Default.aspx str�nku

T�to sekcia vytvor� sk��obn� stranu na ktor� pou��vatelia bud� presmerovan� po ich overenie. Ke� pou��vatelia preh�ad�vaj� na t�to str�nku bez prv�ho prihl�senia k aplik�cii, oni s� presmerovan� na str�nku prihl�senia.

1. Premenova� existuj�ci WebForm1.aspx str�nky ako napr�klad Default.aspx, a otvorenie v editore.
2. Prepnite na zobrazenie HTML, a skop�rujte nasleduj�ci k�d medzi The<form>Tagy: </form>

   <input type="submit" Value="SignOut" runat="server" id="cmdSignOut">
   						

   Toto tla�idlo sa pou��va na odhl�senie overovanie formul�rov rel�cie.
3. Prepn�� do n�vrhov�ho zobrazenia a ulo�te str�nku.
4. Importova� po�adovan� priestory n�zvov v s�bore k�d pozadu:

   using System.Web.Security;
   					

5. Dvojit�m kliknut�m SignOut otvoren� k�d-za str�nky (Default.aspx.cs) a k�pia nasleduj�ci k�d v popisova�i udalosti cmdSignOut_ServerClick :

   private void cmdSignOut_ServerClick(object sender, System.EventArgs e)
   {
      FormsAuthentication.SignOut();
      Response.Redirect("logon.aspx", true);
   }
   					

6. Uistite sa, �e sa prid�va tento k�d do InitializeComponent met�da v k�de, ktor� generuje n�vrh�r formul�ra Web:

   this.cmdSignOut.ServerClick += new System.EventHandler(this.cmdSignOut_ServerClick);
   					

7. Ulo�i� a zostavi� projekt. Teraz m��ete pou�i� aplik�cia.

�al�ie pozn�mky

• Mo�no budete chcie� uklada� hesl� bezpe�ne v datab�ze. Ste m��ete pou�i� FormsAuthentication trieda utility funkcie vymenoval HashPasswordForStoringInConfigFile pre �ifrovanie hesiel, predt�m, ne� si ich ulo�i� do datab�zy alebo konfigura�n� s�bor.
• Mo�no budete chcie� ulo�i� inform�cie o pripojen� SQL v konfigura�n� s�bor (Web.config) tak, �e si m��ete �ahko zmeni�, ak potrebn�.
• M��ete zv�i� pridanie k�du pre prevenciu hackerov, ktor� sa sna�ia pou��va� r�zne kombin�cie hesiel v prihl�sen�. Napr�klad, m��ete zah��aj� logick�, �e akceptuje iba dva alebo tri pokusy o prihl�senie. Ak pou��vate� nem��e Prihl�ste sa ur�itom po�te pokusov, mo�no budete chcie� nastavi� pr�znak Datab�za neumo��uje dan�ho pou��vate�a o prihl�senie, k�m pou��vate� re-enables svojho ��et t�m, �e nav�t�vite in� str�nku alebo volaj�ceho podporu. V Navy�e, mali by ste prida� vhodn� chyba manipul�cia kdeko�vek potrebn�.
• Preto�e pou��vate� je ur�en� na overovanie cookie, mo�no budete chcie� pou�i� Secure Sockets Layer (SSL) na t�to aplik�ciu tak �e nikto m��e klama� overovac�m s�borom cookie a in� cenn� inform�cie, ktor� s� pren�an�.
• Overovanie na z�klade formul�rov vy�aduje, aby v� klient alebo povoli� cookies vo svojom prehliada�i.
• Parameter �asov�ho limitu<authentication></authentication> �asti Konfigur�cia ur�uje interval, v ktorom overovac�m s�borom cookie sa regeneruje. M��ete si vybra� hodnotu, ktor� poskytuje lep�� v�kon a bezpe�nos�.
• Ur�it�m, sprostredkuj�ca proxy a cache na internete m��e cache Web server odpoved�, ktor� obsahuj� hlavi�ky s�boru Cookie, ktor� s� potom vr�til in� pou��vate�. Preto�e pou��va s�bor cookie aj overovanie na z�klade formul�rov na overenie pou��vate�ov, to m��e sp�sobi� pou��vate�om n�hodne (alebo �myselne) zosobnenie in� pou��vate� dostane cookie z sprostredkovate�sk� proxy alebo cache, ktor� bolo p�vodne ur�en� pre nich.

�al�ie inform�cie o tom, ako realizova� jednoduch� overovanie na z�klade formul�rov, ktor� pou��va <credentials></credentials> oddiel na ukladanie pou��vatelia a hesl�, odkazova� na nasleduj�ce GotDotNet ASP.NET QuickStart vzorky: �al�ie inform�cie o implementovan� z�klade formul�rov overovania, ktor� pou��va XML s�bor na ukladanie pou��vatelia a hesl�, ozna�ova� Nasleduj�ca t�ma v .NET Framework Software Development Kit (SDK) dokument�cia: �al�ie inform�cie o ASP.NET Web aplik�cie zabezpe�enia, ozna�ova� nasleduj�ci Microsoft.NET Framework Developer's Guide dokument�cia: �al�ie inform�cie o priestore n�zvov System.Web.Security , ozna�ova� nasleduj�ci Microsoft.NET Framework Referen�n� dokumenty: �al�ie inform�cie o ASP.NET konfigur�cie, odkazova� na nasleduj�ci Microsoft.NET Framework Developer's Guide �l�nky: Inform�cie o ASP.NET bezpe�nostn� pokyny, nasleduj�ce MSDN bielej knihy: